← voltar
CVE-2014-9224

CVE-2014-9224

EPSS 4.6%
Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Produtos afetados
n/a · n/a
PoCs públicas encontradas — 2
cve_referencepacketstormsecurity.com/files/130060/Symantec-SDCS-SA-SCSP-XSS-Bypass-SQL-Injection-Disclosure.htmlnão verificadoexploitdbwww.exploit-db.com/exploits/35915não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
http://packetstormsecurity.com/files/130060/Symantec-SDCS-SA-SCSP-XSS-Bypass-SQL-Injection-Disclosure.htmlhttp://seclists.org/fulldisclosure/2015/Jan/91http://www.securityfocus.com/archive/1/534527/100/0/threadedhttp://www.securityfocus.com/bid/72093http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150119_00